If you are a Small Business customer, find additional troubleshooting and learning resources at the Support for Small Business site.

Windows File Protection (WFP) prevents programs from
replacing critical Windows system files. Programs must not overwrite these
files because they are used by the operating system and by other programs.
Protecting these files prevents problems with programs and the operating
system.

WFP protects critical system files that are installed as part
of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and
some True Type fonts). WFP uses the file signatures and catalog files that are
generated by code signing to verify if protected system files are the correct
Microsoft versions. Replacement of protected system files is supported only
through the following mechanisms:

Windows Service Pack installation using
Update.exe

Hotfixes installed using Hotfix.exe or
Update.exe

Operating system upgrades using Winnt32.exe

Windows Update

If a program uses a different method to replace protected
files, WFP restores the original files. The Windows Installer adheres to WFP
when installing critical system files and calls WFP with a request to install
or replace the protected file instead of trying to install or replace a
protected file itself.

How the WFP feature works

The WFP feature provides protection for system files using two
mechanisms. The first mechanism runs in the background. This protection is
triggered after WFP receives a directory change notification for a file in a
protected directory. After WFP receives this notification, WFP determines which
file was changed. If the file is protected, WFP looks up the file signature in
a catalog file to determine if the new file is the correct version. If the file
is not the correct version, WFP replaces the new file with the file from the
cache folder (if it is in the cache folder) or from the installation source.
WFP searches for the correct file in the following locations, in this order:

The cache folder (by default,
%systemroot%\system32\dllcache).

The network install path, if the system was installed using
network install.

The Windows CD-ROM, if the system was installed from
CD-ROM.

If WFP finds the file in the cache folder or if the installation source is automatically located, WFP silently replaces the file and logs an event that resembles the following in the System log:

Event ID: 64001
Source: Windows File Protection
Description: File replacement was attempted on the protected system file c:\winnt\system32\ file_name . This file was restored to the original version to maintain system stability. The file version of the system file is x.x:x.x.

If WFP cannot
automatically find the file in any of these locations, you receive one of the
following messages, where file_name is the name of
the file that was replaced and product is the
Windows product you are using:

Windows File ProtectionFiles
that are required for Windows to run properly have been replaced by
unrecognized versions. To maintain system stability, Windows must restore the
original versions of these files. Insert your
product CD-ROM now.

Windows File ProtectionFiles
that are required for Windows to run properly have been replaced by
unrecognized versions. To maintain system stability, Windows must restore the
original versions of these files. The network location from which these files
should be copied,
\\server\share, is not
available. Contact your system administrator or insert
product CD-ROM now.

Note If an administrator is not logged on, WFP cannot display either
of these dialog boxes. In this situation, WFP displays the dialog box after an
administrator logs on. WFP may wait for an administrator to log on in the following scenarios:

The SFCShowProgress registry entry is missing or is set to 1, and the server is set to scan every time that the computer starts. In this situation, WFP waits for a console logon. Therefore, the RPC server does not start until the scan is performed. The computer has no protection during this time.

Note You can still map network drives, use system files, and use Terminal Services to log on to the server. WFP does not consider these operations as a console logon, and keeps waiting indefinitely.

WFP has to restore a file from a network share. This situation may occur if the file is not present in the Dllcache folder or if the file is corrupted. In this situation, WFP may not have the correct credentials to access the share from the network-based installation media.

The second protection
mechanism that is provided by the WFP feature is the System File Checker
(Sfc.exe) tool. At the end of GUI-mode Setup, the System File Checker tool
scans all the protected files to make sure that they are not modified by
programs that were installed by using an unattended installation. The System
File Checker tool also checks all the catalog files that are used to track
correct file versions. If any of the catalog files are missing or damaged, WFP
renames the affected catalog file and retrieves a cached version of that file
from the cache folder. If a cached copy of the catalog file is not available in
the cache folder, the WFP feature requests the appropriate media to retrieve a
new copy of the catalog file.

The System File Checker tool gives an
administrator the ability to scan all the protected files to verify their
versions. The System File Checker tool also checks and repopulates the cache
folder (by default, %SystemRoot%\System32\Dllcache). If the cache folder
becomes damaged or unusable, you can use either the sfc /scanonce command or the sfc /scanboot command at a command prompt to repair the contents of the folder.

= scan all protected files after every restart (set if sfc /scanboot is run).

0x2

= scan all protected files one time after a restart (set if sfc /scanonce is run).

By default, all system files are cached in the cache folder,
and the default size of the cache is 400 MB. Because of disk space
considerations, it may not be desirable to maintain cached versions of all
system files in the cache folder. To change the size of the cache, change the
setting of the

There are two cases in which the cache folder may not
contain copies of all protected files, regardless of the SFCQuota value:

Not enough disk space.

Under Windows XP, WFP
stops populating the Dllcache folder when less than (600 MB + maximum size of
the page file) of space is available on the hard disk. Under Windows 2000,
WFP stops populating the Dllcache folder when less than 600 MB of space is
available on the hard disk.

Network Install.

When Windows 2000 or Windows XP
is installed over the network, files in the i386\lang directory are not
populated in the Dllcache folder.

Additionally, all drivers in the Driver.cab file are protected,
but they are not populated in the Dllcache folder. WFP can restore these files
from the Driver.cab file directly without prompting the user for the source
media. However, running the sfc /scannow command does populate the files from the Driver.cab file into the
Dllcache folder.

If WFP detects a file change and the affected file
is not in the cache folder, WFP examines the version of the changed file that
the operating system is currently using. If the file that is currently in use
is the correct version, WFP copies that version of the file to the cache
folder. If the file that is currently in use is not the correct version, or if
the file is not cached in the cache folder, WFP tries to locate the
installation source. If WFP cannot find the installation source, WFP prompts an
administrator to insert the appropriate media to replace the file or the cached
file version.

The

SFCDllCacheDir

value (

REG_EXPAND_SZ

) in the following registry key specifies the location of the
Dllcache folder.